@trylight/app 0.3.0 → 0.3.1

package/dist/auth/core.d.ts

@@ -5,11 +5,11 @@ import { type MiiUser, type ResolvedSession } from "./lookup.js";
 import { type MiiIdentity, type PlazaSession } from "./plaza.js";
 export type { MiiUser, ResolvedSession } from "./lookup.js";
 export type { AuthMode } from "./mode.js";
-export type { MiiIdentity, PlazaSession, SignedIn, SignInFailure, SignInResult } from "./plaza.js";
+export type { MiiIdentity, PasswordResetResult, PlazaSession, SignedIn, SignInFailure, SignInResult } from "./plaza.js";
 export { SIGN_IN_PROBLEMS } from "./problems.js";
 export { safeNext } from "./next-path.js";
 export { SESSION_COOKIE } from "./lookup.js";
-export { signInWithPlaza } from "./plaza.js";
+export { requestPasswordResetWithPlaza, signInWithPlaza } from "./plaza.js";
 export type CreateMiiAuthCoreOptions = {
     /** Where to report failures that are ours, not the person's. Defaults to console.error. */
     readonly reportError?: (error: unknown, context: Record<string, string>) => void;

package/dist/auth/core.js

@@ -8,7 +8,7 @@ import { deactivateUser, upsertMemberFromIdentity } from "./users.js";
 export { SIGN_IN_PROBLEMS } from "./problems.js";
 export { safeNext } from "./next-path.js";
 export { SESSION_COOKIE } from "./lookup.js";
-export { signInWithPlaza } from "./plaza.js";
+export { requestPasswordResetWithPlaza, signInWithPlaza } from "./plaza.js";
 /**
  * Cookie attributes the app must use with issueSession's token: inside the platform's App pane the app is a third party, so the
  * cookie must be SameSite=None + Secure + partitioned or the pane signs in

package/dist/auth/plaza.d.ts

@@ -47,6 +47,14 @@ export type SignInResult = ({
  * the session the platform signed for them.
  */
 export declare function signInWithPlaza(email: string, password: string): Promise<SignInResult>;
+export type PasswordResetResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly failure: SignInFailure;
+};
+/** `returnTo` is this app's login, where the platform's reset page sends the person afterwards. */
+export declare function requestPasswordResetWithPlaza(email: string, returnTo: string): Promise<PasswordResetResult>;
 /**
  * Spend a code for the person behind it, or null if it is spent or stale.
  *

package/dist/auth/plaza.js

@@ -45,6 +45,32 @@ export async function signInWithPlaza(email, password) {
         failure: failureFor(response.status, await response.text())
     };
 }
+/** `returnTo` is this app's login, where the platform's reset page sends the person afterwards. */
+export async function requestPasswordResetWithPlaza(email, returnTo) {
+    const { plazaUrl, appId } = miiAuthConfig();
+    let response;
+    try {
+        response = await fetch(`${plazaUrl}/api/app-auth/request-password-reset`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ appId, email, returnTo }),
+            cache: "no-store"
+        });
+    }
+    catch (cause) {
+        return {
+            ok: false,
+            failure: {
+                kind: "unavailable",
+                message: "Password reset is unreachable right now. Try again in a moment.",
+                cause
+            }
+        };
+    }
+    if (response.ok)
+        return { ok: true };
+    return { ok: false, failure: failureFor(response.status, await response.text()) };
+}
 /**
  * Spend a code for the person behind it, or null if it is spent or stale.
  *
@@ -143,7 +169,7 @@ function failureFor(status, body) {
     if (status === 429) {
         return {
             kind: "throttled",
-            message: "Too many wrong tries. Wait a minute and try again."
+            message: "Too many tries. Wait a minute and try again."
         };
     }
     return {

package/dist/platform/server-fn-door.js

@@ -3,14 +3,15 @@
 // whose functions forget their own guard serves the org's data to anyone.
 /**
  * The template's server functions a signed-out visitor needs to become signed
- * in: who am I, the two ways to sign in, signing out, and the config the login
- * page renders with.
+ * in: who am I, the two ways to sign in, a forgotten password, signing out,
+ * and the config the login page renders with.
  */
 const SIGN_IN_SERVER_FNS = [
     "src/lib/auth.ts#getSessionUser",
     "src/lib/auth.ts#redeemPaneCode",
     "src/lib/auth.ts#loginWithPassword",
-    "src/lib/auth.ts#logout",
+    "src/lib/auth.ts#requestPasswordReset",
+    "src/lib/auth.ts#signOut",
     "src/routes/__root.tsx#getPlatformConfig"
 ];
 /**

package/dist/server/index.d.ts

@@ -1,6 +1,6 @@
 import { type PostgresJsDatabase } from "drizzle-orm/postgres-js";
 import { type Contracts } from "../invoke/server.js";
-export type { SessionState, SessionUser, SignIn } from "./session.js";
+export type { PasswordResetRequest, SessionState, SessionUser, SignIn } from "./session.js";
 export { cookieAttributes, safeNext, SESSION_COOKIE } from "../auth/core.js";
 export { defineContracts, InvocationError, type Contracts } from "../invoke/server.js";
 export { createHealthHandler } from "./health.js";
@@ -15,6 +15,7 @@ export declare function createLightServer<S extends Record<string, unknown>, C e
     configured: () => boolean;
     /** Email and password, checked by the platform; the session to set as a cookie, or why not. */
     signIn: (email: string, password: string) => Promise<import("./session.js").SignIn>;
+    requestPasswordReset: (email: string, returnTo: string) => Promise<import("./session.js").PasswordResetRequest>;
     /** The app's database, typed by its schema: `light.db.select().from(companies)`. */
     readonly db: PostgresJsDatabase<S>;
     /** `/api/light/entities/*`: what `app.table(...)` calls. */

package/dist/server/index.js

@@ -9,7 +9,7 @@ import { createMiiInvoke } from "../invoke/server.js";
 import { createEntitiesHandler } from "./entities.js";
 import { env } from "./env.js";
 import { createImageHandler } from "./images.js";
-import { readSession, signIn } from "./session.js";
+import { readSession, requestPasswordReset, signIn } from "./session.js";
 export { cookieAttributes, safeNext, SESSION_COOKIE } from "../auth/core.js";
 export { defineContracts, InvocationError } from "../invoke/server.js";
 export { createHealthHandler } from "./health.js";
@@ -38,6 +38,7 @@ export function createLightServer(options) {
         configured: () => env().configured,
         /** Email and password, checked by the platform; the session to set as a cookie, or why not. */
         signIn: (email, password) => signIn(auth, email, password),
+        requestPasswordReset: (email, returnTo) => requestPasswordReset(email, returnTo),
         /** The app's database, typed by its schema: `light.db.select().from(companies)`. */
         get db() {
             return db();

package/dist/server/session.d.ts

@@ -16,3 +16,10 @@ export type SignIn = {
 };
 /** The login form's whole job: the platform checks the password, the app starts a session. */
 export declare function signIn(auth: MiiAuthCore, email: string, password: string): Promise<SignIn>;
+export type PasswordResetRequest = {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+export declare function requestPasswordReset(email: string, returnTo: string): Promise<PasswordResetRequest>;

package/dist/server/session.js

@@ -1,5 +1,5 @@
 // Who is asking, as the app's door sees it, and signing in through the platform.
-import { signInWithPlaza } from "../auth/core.js";
+import { requestPasswordResetWithPlaza, signInWithPlaza } from "../auth/core.js";
 import { readCookie } from "../chat/server.js";
 import { env } from "./env.js";
 /** The session a request's cookie names, and whether the app is members-only. */
@@ -34,3 +34,11 @@ export async function signIn(auth, email, password) {
     const session = await auth.issueSession(member.id, result.session);
     return { ok: true, ...session };
 }
+export async function requestPasswordReset(email, returnTo) {
+    if (!env().configured)
+        return { ok: false, message: "Sign-in is not configured." };
+    const result = await requestPasswordResetWithPlaza(email, returnTo);
+    if (!result.ok)
+        return { ok: false, message: result.failure.message };
+    return { ok: true };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trylight/app",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "The Light SDK every v2 org app depends on: entities (Drizzle tables with a typed client), sign-in, contracts and in-app chat.",
   "license": "UNLICENSED",
   "type": "module",
@@ -12,7 +12,6 @@
     "url": "https://github.com/shubh9/mii.git",
     "directory": "packages/app-sdk"
   },
-  "packageManager": "pnpm@11.0.9",
   "files": [
     "dist",
     "bin"
@@ -42,15 +41,6 @@
       "default": "./dist/vite.js"
     }
   },
-  "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint src test --max-warnings 0",
-    "test": "node --test --import tsx \"test/**/*.test.ts\"",
-    "check": "tsx scripts/write-brand.ts --check && pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run build",
-    "prepack": "pnpm run build",
-    "brand": "tsx scripts/write-brand.ts"
-  },
   "peerDependencies": {
     "@tanstack/react-query": ">=5.69",
     "@tanstack/react-router": ">=1.170",
@@ -84,5 +74,13 @@
     "typescript-eslint": "^8.70.1",
     "vite": "^8.2.0",
     "zod": "^4.6.5"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src test --max-warnings 0",
+    "test": "node --test --import tsx \"test/**/*.test.ts\"",
+    "check": "tsx scripts/write-brand.ts --check && pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run build",
+    "brand": "tsx scripts/write-brand.ts"
   }
-}
+}